Category: Palo Alto Networks

Posted on

OilRig Uses ISMDoor Variant; Possibly Linked to Greenbug Threat Group

Unit 42 has discovered activity involving threat actors responsible for the OilRig campaign with a potential link to a threat group known as GreenBug. Symantec first reported on this group back in January 2017, detailing their operations and using a custom information stealing Trojan called ISMDoor.

In July 2017, we observed an attack on a Middle Eastern technology organization that was also targeted by the OilRig campaign in August 2016. Initial inspection of this attack suggested this was again the OilRig campaign using their existing toolset, but further examination revealed not only new variants of the delivery document we named Clayslide, but also a different payload embedded inside it. In the past, we had primarily associated the OilRig campaign with using the Clayslide documents to deliver as a payload a Trojan we named Helminth; in this instance, the payload was instead a variant of the ISMDoor Trojan with significant modifications which we are now tracking as ISMAgent.

The Attack

On July 16, 2017, actors associated with the OilRig campaign sent emails to five different individuals within the targeted organization. All of the emails sent had the same subject, attachment filename, and attached Excel file (SHA256: 3eb14b6705179590f0476d3d3cbd71665e7c1935ecac3df7b876edc9bd7641b6).

We identified the Excel file attached to the delivery email as a variant of the Clayslide delivery documents used by the OilRig campaign. A closer look revealed that although it was similar to previous Clayslide documents, it was also quite different in several aspects. Like the previous samples, it displays a worksheet titled “Incompatible” containing a banner that shows a fake compatibility warning message (Figure 1). The message is an attempt to trick the user into clicking the “Enable Content” button, which would run a malicious macro embedded within the Excel file

Figure 1 Incompatible message attempting to trick the victim into enabling macros

The macro within the delivery document will unhide and display a new worksheet that contains a fake invoice for Citrix products, as seen in Figure 2. This fake invoice acts as a decoy document to minimize the user’s suspicions that any malicious activity occurred.

Figure 2 Decoy document opened to minimize suspicions of compromise

While the macro displays the decoy invoice spreadsheet, it silently runs malicious code in the background to install its payload. The malicious code starts by concatenating several base64 encoded strings into a single variable. As you can see in the following code snippet, the variable name “Paltofp1” suggests that the author of this code may want our attention:

The macro then writes the concatenated base64 encoded data to the file %PUBLIC%\Libraries\B642.txt. It then reads in the “B642.txt” file and decodes the data, which it will save to the file %PUBLIC%\Libraries\servicereset.exe (SHA256: 52366b9ab2eb1d77ca6719a40f4779eb302dca97a832bd447abf10512dc51ed9). The servicereset.exe file is the payload of this attack, which is a variant of ISMDoor that we track as ISMAgent.

The script then creates a file named %PUBLIC%\Libraries\OfficeServicesStatus.vbs which contains a VBScript that will execute the “servicereset.exe” file using the command line. Lastly, as a persistence mechanism, a scheduled task named “OfficeServicesStatus” will be created, set to run every three minutes, as seen in Figure 3.

Figure 3 Scheduled task created by the macro within the delivery document

An Iterative Task

While hunting for other samples similar to the one observed in the attack against the technology organization, we discovered yet another variant of Clayslide (SHA256: 5ac939a5426db8614165bd8b6a02d3e8d9f167379c6ed28025bf3b37f1aea902). This sample was dated June 2017, a month older than the newest version containing ISMAgent. Based upon timestamping and similarities with both the original Clayslide documents as well as the newest ISMAgent loaded ones, we believe this June 2016 sample to be an iterative version of Clayslide.

The June 2017 sample of Clayslide contained the same OfficeServicesStatus.vbs file found in the ISMAgent Clayslide document, but instead of having the payload embedded in the macro as segregated base64 strings that would be concatenated, this variant obtained its payload from multiple cells within the “Incompatible” worksheet. This technique was observed in previous Clayslide documents to access the script variant of the Helminth Trojan in earlier OilRig attacks.

Also, the June 2017 sample contained artifacts observed in previous Clayslide documents as documented in a blog postwe published in April. Specifically, we found this comment:

along with the following common function names within the macro code:

Although structurally the document was more similar to the originally discovered Clayslide documents, this June 2017 sample was designed to load ISMAgent instead of Helminth. We do not have targeting details for this sample, although the decoy document contained a similar theme to the newest Clayslide document, displaying vendor related information (Figure 4).

Figure 4 Decoy document

A table displaying the differences in each variant of Clayslide is below:

Original Clayslide June Clayslide Newest Clayslide
Helminth X
ISMAgent X X
OfficeServicesStatus X X
Base64 in multiple cells X X
Source code comment X X

Table 1 Comparison of Clayslide versions

The payload (SHA256: 52366b9ab2eb1d77ca6719a40f4779eb302dca97a832bd447abf10512dc51ed9) delivered in the June 2016 attack is a variant of the recent ISMDoor versions that use DNS tunneling for its C2 communications. On May 1, 2017, Arbor Networks published research on ISMDoor using DNS tunneling to communicate with its C2 server, which is nearly identical to the DNS tunneling the payload of this attack carries out. Due to considerable differences and evidence of potentially different authors between the previous ISMDoor samples and this newly discovered variant, we are tracking this new variant as ISMAgent.

On-demand Configuration

The ISMAgent tool comes with a default configuration that specifies the C2 domain and the number of minutes between further attempts to execute the tool. However, an actor can use command line arguments to create a new ISMAgent sample that is configured with a specified C2 domain and a specified number of minutes to automatically execute the Trojan. The following command line arguments are supported:

Argument Description
-c Configures a second domain to use for C2 communications
-m Configures the number of minutes that a scheduled task should execute the payload

Table 2 Command line options available in ISMAgent for configuration

If the Trojan is executed with these arguments, the Trojan will read its own file data in, and search for two strings of characters within the data that it will overwrite with the configured settings. The Trojan searches for a string of “^” characters that it will overwrite with the C2 domain provided via the “-c” argument, and it searches for the string “%%%%” that it will replace with the number of minutes provided via the “-m” argument. The “%%%%” string exists within the following larger string, that the Trojan uses as a command to execute in order to create a scheduled task named “TimeUpdate” to execute the payload after the specified number of minutes passes:

Command and Control

The Trojan is able to use two mechanisms to communicate with its C2 server: HTTP requests and DNS tunneling. The DNS tunneling protocol found in this payload is remarkably similar to recent ISMDoor samples, as documented in Arbor Networks’ research. Similar message handling is found in both ISMAgent and ISMDoor, in addition to the existence of strings in both samples, such the hardcoded IPv6 values. The similarities may allow for backward compatibility between ISMAgent and ISMDoor C2 infrastructure. In the payloads themselves, a number of differences exist, enough that in essence they appear to be different tools.

Regardless of the communications method used, the Trojan will parse the received data from the C2 server for a GUID field that the Trojan will use as a unique identifier, as well as commands the Trojan should run on the compromised system:

HTTP C2 Communications

ISMAgent prioritizes HTTP as its mechanism to communicate with the C2 server, but if it is unable to reach the C2 server it will switch to the DNS tunneling mechanism. To carry out its HTTP C2 communications, the Trojan prepends “www.” to the configured C2 domain and issues a DNS query to resolve this domain. The Trojan will use the resolved IP address as the host in the HTTP beacon request.

For instance, the sample used in this attack was configured to use ntpupdateserver[.]com for its C2 server. The HTTP C2 process would attempt to resolve the domain “www.ntpupdateserver[.]com”, which resolved to 142.54.179[.]90, so the Trojan would use the string “http:/w” as the basis of the C2 URL.  The initial beacon sent from the Trojan to the C2 server using a URL structured in the following way:

The C2 server will respond to this request with a command string using the previously mentioned format. During the attack on the technology organization, we observed the C2 server issuing the following command:

If the C2 server provides a command to execute on the system, the Trojan executes it using cmd.exe and writes the output to %TEMP%\runlog[random number].tmp. The Trojan will read this runlog file and send it to the C2 server via an HTTP POST request to a URL structured as follows:

The HTTP POST request contains an anomalous boundary value of “myboundary” and hardcoded filename value of “a.a”, as seen below, which may be used to generate detection signatures for this behavior:

While we did not observe the C2 server attempting to run additional commands via ISMAgent, we were able to analyze the Trojan itself to determine the functionality of its available commands. If the command string contains a URL to download a file to the system, the Trojan will simply use the URLDownloadToFileA function to download and save the file to the target system in the %TEMP% folder. If the C2 server provides a path to a file it wishes to upload from the system, the Trojan will open the file, read its contents, and then upload its contents via an HTTP POST to the following URL:

DNS Tunneling for C2

ISMAgent uses its DNS tunneling technique for C2 as a backup to its HTTP capability. This mechanism supports the same command message structure and even handles the commands in the same manner. The Trojan sends data to the C2 server via DNS queries by encoding data and using the encoded string as a subdomain of an actor owned domain. The C2 server can send data to the Trojan by resolving the DNS queries to IPv6 addresses that the Trojan treats as hexadecimal data.

To carry out its DNS C2 communications, the Trojan will issue DNS queries to the C2 domain to obtain the AAAA records associated with the domain. The Trojan starts this process by creating a unique GUID and appending it to the string “n.n.c.” to create a subdomain to query in the following format:

To respond to this beacon, the C2 domain’s name server will respond to this query with a hardcoded IPv6 value of a67d:0db8:a2a1:7334:7654:4325:0370:2aa3. This value acts as an acknowledgement of the beacon. The Trojan will then base64 encode the HTTP C2 URL it was using and will send this data to the C2 by constructing and issuing the following DNS query:

The Trojan splits up the base64 encoded data across several DNS queries, which we believe the C2 domain’s name server pieces together using the supplied sequence numbers. The name server will respond to each of these DNS queries with another hardcoded IPv6 value of a67d:0db8:85a3:4325:7654:8a2a:0370:7334 to notify the Trojan that it has received the data. After all of the data is successfully sent via DNS requests, the Trojan will send a final DNS query that has the following structure to notify the C2 server that it has completed its data transfer:

After notifying the C2 server that the data transfer has completed, the Trojan may issue additional DNS queries to notify it is ready to receive data back from the C2 server using the following domain name structure:

The DNS server will then respond to these DNS queries with additional IPv6 addresses that the Trojan will treat as hexadecimal data as described by Arbor Networks.

Infrastructure

The ISMAgent payload embedded inside the newest variant of Clayslide used the C2 domain ntpupdateserver[.]com. The primary second-level domain has no IP resolution, instead relying on http://www.ntpupdateserver[.]com for resolution then two specific subdomains of ns1.ntupdateserver[.]com and ns2.ntpupdateserver[.]com as the actual DNS C2 handler. The ISMAgent payload embedded inside the June version used a completely different C2 domain at Microsoft-publisher[.]com, but used the exact same domain name structure. Lastly, we were able to identify a third sample of ISMAgent leveraging another unique C2 domain, adobeproduct[.]com.

Figure 5 Primary C2 domains for ISMAgent

Pivoting from the WHOIS registrant email address of paul.mcalister[at]mail.com revealed four additional highly suspect domains:

Pivoting on the WHOIS phone number we found two additional domains. These are registered with the same Registrar, have the same WHOIS address, but the registrant name “bolips Angelio” and email address bolips[at]outlook.com.

Thematically, these domains follow the pattern of ISMAgent and OilRig C2 domain names, abusing typo-squatting techniques in attempts to appear as legitimate domains. Each of these additional domains had the same structure as the three ISMAgent C2 domains, with no IP resolution on the primary second-level domain containing the www, ns1, and ns2 subdomains. Based off the same registrant email address and domain name structure, it is highly probable these other domains are also part of the ISMAgent infrastructure as C2 servers.

Lastly, we identified another ISMAgent sample using the C2 domain of adobeproduct[.]com, which again fits thematically and was also found to have the www, ns1, and ns2 subdomains attached to it.

These findings are diagrammed below:

Figure 6 ISMAgent C2 Infrastructure

ISMAgent vs. ISMDoor

On the surface, the ISMAgent payload appears similar to the ISMDoor payload, sharing functionality such as a specific DNS tunneling protocol. However, closer analysis shows there are enough differences between the two payloads that justifies tracking ISMAgent as its own tool with its own name.

First, all known ISMDoor payloads using DNS tunneling were created for 64-bit architectures, while all known ISMAgent are x86 only. The most recent ISMDoor payloads using DNS tunneling have abandoned HTTP as a C2 communications method compared to earlier ISMDoor samples, whereas ISMAgent uses HTTP as the primary method and DNS tunneling as a secondary method to communicate with its C2 server.

Also, while the DNS tunneling protocol is the same, the messages within the transmitted encoded data differs dramatically. After the initial “n.n.c.” beacon, ISMAgent sends the HTTP C2 URL as the data via the DNS tunneling protocol to send a beacon to its C2. During our analysis, we observed the sample used in this attack sending the following data immediately after the initial beacon:

Comparatively, ISMDoor sends a much more involved series of messages to the C2 server in order to get a command. The following is a sequence of messages sent from the ISMDoor Trojan to its C2 server via the DNS tunneling protocol, the last message (“M:GAC?”) resulting in a command for the Trojan to run:

Lastly, the commands available within ISMAgent and ISMDoor are very different. As mentioned previously, ISMAgent has a far more limited, but flexible command set, allowing an adversary to upload and download files, in addition to command execution via command prompt. The most recent version of ISMDoor (v 10.0.192 SHA256: aa52dcaf6df43c6aa872fe0f73725f61e082d32c33fc976741d4eca17679533d) on the other hand, has a more comprehensive yet more rigid command set:

From Helminth to ISMAgent

During our data collection process, we discovered a Clayslide delivery document (SHA256: ca8cec08b4c74cf68c71a39176bfc8ee1ae4372f98f75c892706b2648b1e7530) from September 2016 containing a payload that appeared to be the Helminth script variant as found in other Clayslide documents, but upon further examination was wholly different. The macro within this Clayslide documents obtains a PowerShell script from a cell in the “Incompatible” worksheet, much like previous samples. The macro then saves a VBScript to %PUBLIC%\Libraries\LicenseCheck.vbs to run this PowerShell script every 3 minutes.

Like the Helminth script variants, this PowerShell script is a malicious payload that uses both HTTP requests and DNS tunneling to interact with its C2 server. However, the HTTP requests and the protocol employed to perform DNS tunneling differs dramatically from Helminth scripts installed by all other known Clayslide samples. The HTTP requests and DNS tunneling protocol found in this PowerShell script are instead identical to ISMAgent.

The C2 domain used for this script was mslicensecheck[.]com, which had previously been reported by LogRhythm in their OilRig whitepaper. Interestingly, it was the only domain associated with OilRig that did not have an IP resolution at its second-level, much like the ISMAgent samples.

The “doIt” function within the PowerShell script, seen in Figure 7, is responsible for initiating the C2 communications, as well as parsing the data provided by the C2 server to run the appropriate commands. This function uses the strings “/action2/”, “/response/” and “/upload/” within the C2 URLs when using HTTP to communicate with the C2 server. This behavior and these strings were also observed in the ISMAgent C2 behavior. The “doIt” function also shows that the C2 server will respond with data structured the same way as ISMAgent, using “#” as a delimiter and various offsets such as offset 0 used in subsequent requests with the C2, offset 2 specifying a URL to download a file from, offset 3 specifying a command to execute using command-prompt, and offset 4 specifying a path to a file to upload to the C2 server.

Figure 7 The ‘doIt’ function within the PowerShell script handles C2 interaction and functionality

The commonalities between this PowerShell script and ISMAgent do not stop there. The HTTP requests to the C2 server use the exact same URL structure. For instance, the payload generates a URL using the following line of code, which results in a base64 encoded string that contains [hostname/username]:

Also, as seen in the code above, the PowerShell script makes sure the base64 encoded data used is safe to use in an HTTP URL, by replacing the characters “=”, “/” and “+” characters with hexadecimal equivalent. The ISMAgent payloads also performed the exact same replacement, as seen in the portion of code in Figure 8.

Figure 8 Code within ISMAgent payload that overlaps character replacement HTTP communications functionality within PowerShell script

The DNS tunneling protocol within the PowerShell script is the same as the ISMAgent payload, which can be visualized by the following beacon sent from the PowerShell script:

To facilitate the DNS tunneling functionality, the PowerShell script replaces the “=”, “/” and “+” characters within the base64 data sent to the C2 server within the subdomains of DNS queries. However, DNS queries cannot include the “%” character, so it uses the following line of code to replace them with “-“, “-s-“ and “-p-“ instead:

This functionality is again replicated within the ISMAgent payload for its DNS tunneling functionality, as shown in Figure 9.

Figure 9 Code within ISMAgent payload that overlaps character replacement within DNS tunneling functionality within PowerShell script

Conclusion

The OilRig campaign has repeatedly demonstrated a willingness and desire to be iterative in their toolset, while maintaining some level of similarities over time. In this scenario, we were able to directly observe this type of behavior, while also implement a tool thought to be previously unrelated to OilRig. With the inclusion of ISMAgent within the OilRig toolset, we are beginning to see stronger relationships between the various documented groups operating in the Middle East. This region has proven to be a hot bed of espionage motivated activity over the last couple of years, and there appear to be no signs of this changing. As our research continues, our goal will be to generate even better understandings of the true extent of the various operations in this region and the relationships between them.

Palo Alto Networks customers are protected and may learn more via the following:

  • Samples are classified as malicious by WildFire and Traps prevents their execution
  • Domains and IPs have been classified as malicious and IPS signatures generated
  • AutoFocus users may learn more via the ISMAgent and Clayslide tags

Indicators of Compromise

Clayslide delivering ISMAgent

3eb14b6705179590f0476d3d3cbd71665e7c1935ecac3df7b876edc9bd7641b6
5ac939a5426db8614165bd8b6a02d3e8d9f167379c6ed28025bf3b37f1aea902

ISMAgent payloads
bbfc05177e5e29b3c8c4ef0148969d07e6239140da5bff57473c32409e76c070
52366b9ab2eb1d77ca6719a40f4779eb302dca97a832bd447abf10512dc51ed9
af4d8604d0cd09b8dc01dbafc33c6d240d356cad366f9917192a2725e0121a0d

ISMAgent C2
Adobeproduct[.]com
ntpupdateserver[.]com
microsoft-publisher[.]com

Related infrastructure

Miedafire[.]com
tatavpnservices[.]com
chrome-dns[.]com
fireeyeupdate[.]com
cache-service[.]net
level3-resolvers[.]net
Mslicensecheck[.]com

 and 

[Palo Alto Networks Research Center]

Posted on

How Traps Protects Against Astrum

Astrum is a relatively old exploit kit (EK) that is also known as Stegano EK. We noted in January 2017 how Stegano/Astrum had reappeared in recent months and talked about how Traps protects against it.

Since then, researchers have seen Astrum updated with new specific countermeasures that target security products and seek to evade detection, making it one of the most evolved threats out there today.

How Does It Work?

Astrum is currently being used as part of the AdGholas malvertising campaign. The AdGholas campaign uses malicious scripts in banner ads on legitimate websites. The malicious scripts direct users to an Astrum exploit kit server behind the scenes which then attacks the user’s system.

Astrum uses malicious Adobe Flash files that attempt to exploit vulnerabilities in Adobe Flash Player (CVE-2015-8651, CVE-2016-1019 and CVE-2016-4117) and Microsoft Internet Explorer (CVE‑2016‑0189). While these vulnerabilities have been patched, users with older versions of Flash and missing Microsoft patches are still at risk of successful attacks against them.

If the malicious Flash file is successful, it will download the payload onto the victim’s machine. Astrum has been known to deliver banking Trojans, including Ursnif. However, recent payloads include ransomware and other malware. Most recently, researchers have seen Astrum spreading the Mole ransomware.

Why Is It Unique?

Since March 2017, researchers have seen Astrum updated with tactics that specifically target detection and analysis.

Astrum exploits an information disclosure vulnerability (CVE-2017-0022) to identify and evade antivirus products. Astrum also utilizes Diffie-Hellman key exchange to incorporate an anti-replay feature to prevent security researchers from reviewing and diverting malicious network activity. Further adding to the challenge of detecting and analyzing Astrum is its use of HTTPS to encrypt its traffic.

And finally, Astrum encrypts the malicious Flash file so that the bulk of the malicious content is encrypted and only a small decryption stub is unencrypted. Astrum takes additional steps to defeat decryption in a sandbox environment by making the ability to decrypt the malicious Flash file machine-specific: the file cannot be decrypted anywhere but on the targeted system.

How Do You Stop It?

Taken all together, these recent updates to Astrum result in it thwarting most security protections. Its use of HTTPS challenges firewall-based protections. Its use of encryption for the malicious payload bypasses most traditional signature-based antivirus solutions. And the machine-specific decryption countermeasure thwarts the sandboxing found on many more advanced security products.

With the advanced evasion techniques Astrum utilizes, endpoint security needs real-time protections to stop Astrum on the target system after the malicious Flash file is decrypted but before it successfully executes.

Palo Alto Networks Traps advanced endpoint protection offers DLL security to prevent access to crucial DLL metadata from untrusted code locations. Traps also offers JIT mitigation to prevent JIT code from calling out-of-the-norm operating system functions. Traps offers unique protections against advanced exploitation capabilities, successfully preventing Astrum and exploit kits of its like.

Attackers will try to evade sandboxes and traditional signature-based antivirus in many unique ways, one of which is described above. However, the attacker cannot disguise the actual malicious activity he is trying to deploy. Traps is anti-evasive and not based on signatures and stops the malicious activity itself, which cannot be hidden or replaced.

[Palo Alto Networks Research Center]

Posted on

Embracing Diversity in Cybersecurity – Key Takeaways From Palo Alto Networks Ignite Diversity Panel

Palo Alto Networks hosted its first-ever diversity panel session at Ignite, our annual end user conference, held this year in Vancouver, Canada. The session, “Embracing Diversity: The Catalyst to Effectively Solve Today’s Toughest Cyber Challenges,” was co-chaired by Carly Chaikin of the popular USA Network cybersecurity TV series “Mr. Robot” and our own Rick Howard, CSO at Palo Alto Networks. The panel was focused on discussing ways to encourage diversity in the field of cybersecurity as a means to protect today’s computing environments, including why different skillsets and cultural perspectives are instrumental in fostering innovation in the space.

Panelists included cybersecurity leaders from different career backgrounds, genders and ethnicities. With speakers from academia, government and industry, the audience heard a range of perspectives on cybersecurity as a career and ways to increase diversity in the field. Our speakers included Suzie Smibert, CISO at Finning International; Christina Ayiotis, co-chair of the advisory board at Georgetown Cybersecurity Law Institute; Teri Takai, former CIO at the U.S. Department of Defense and state of California; Lieutenant General Rhett Hernandez, former Commander of the U.S. Army Cyber Command; and Rinki Sethi, senior director of information security, Palo Alto Networks, U.S.

As a member of the organizing committee for the panel, I had been a little worried that only women would show up to the session, even though men also have an important role to play in increasing diversity in gender, perspectives and backgrounds in the field. However, it was amazing to see the high turnout of male attendees at the session and how much they cared about the diversity challenge in cybersecurity. The event allowed both women and men to share their insights and feelings on the subject. My colleagues and I go to many cybersecurity conferences around the world, and almost always, over 90 percent of audience and speakers at these events are men. It is rare to see female speakers.

According to the Women’s Society of Cyberjutsu, only 11 percent of the information security workforce is women. About 50 percent of IT users are women, so why not increase the ratio of women in cybersecurity to prevent successful cyberattacks and protect the digital age in which we live? It’s clear we need to bring more women into cybersecurity.

It was a full house in the panel room, and the vibe was electric. I sincerely hope that everyone who participated in the event felt inspired to join or stay in the cybersecurity field, or to encourage their colleagues, mentees, daughters and sons to be part of this exciting area. Every panelist emphasized the importance of having the courage to withstand potential judgment of their background or gender, and to bring their unique perspectives to their workplace. Even if some people may judge your past, not your prospects, you have to be brave enough to break away from that negativity, stay true to yourself and shatter the glass ceiling.

This should not discourage you from having a mentor or mentors who can challenge and help you grow professionally. Cybersecurity covers a wide variety of areas of expertise, such as artificial intelligence, business management and strategy, coding, endpoints, legal, networking, government policy, reverse engineering, and threat intelligence, just to name a few. Nobody knows everything about cybersecurity, and this field requires teamwork and collaboration. For this reason, the flexibility to accept different ideas and perspectives is indispensable.

Toward the end of the session, an attendee asked the speakers for career advice. She shared how she felt intimidated and unsure if she was “good enough” to get a new position she was aspiring to have. She’s not alone: A lot of people relate to her in this competitive market. To this courageous question, one panelist encouraged her to avoid using diminishing descriptions about herself and her skillset, and to stand and speak with confidence. This is just the first step to becoming more confident in the workplace and making changes in her professional life.

Cybersecurity is evolving quickly. Those in the field need to be competitive and open to new perspectives to stay up to date on the latest cyberthreats and technology. As Japanese mathematician Dr. Masahiko Fujiwara pointed out in his essay, “Gakumon wo kokorozasu hito he – Hanna heno tegami [To those who want to be in academia – my letter to Hanna],” those who want to be academics need to develop certain characteristics: be intellectually curious, be ambitious, and stay persistent and optimistic, even when things are difficult and you want to give up your goal. This also applies to cybersecurity professionals. If you can keep pushing the envelope for years, you can be anything – a C-suite executive, a general or a top-notch researcher – and pave the way for the next generation of upcoming cybersecurity talent.

Over the last few months, I’ve had the pleasure of speaking with four young women from different backgrounds and nationalities, from an undergraduate student to a mid-career professional. They are passionate about studying technology and policy and finding a job that bridges the gap between the two communities, which have their own unique cultures and languages. Witnessing their intellectual curiosity and ambition during our phone calls and face-to-face meetings made me smile. Many more women around the world are also enthusiastic about cybersecurity, which provides hope for the field as well as for increasing diversity in cybersecurity globally. They are our future.

The diversity panel occurred at the perfect time: right after the Ignite General Session, when Palo Alto Networks President Mark Anderson announced the new partnership between Palo Alto Networks and the Girl Scouts to deliver the first-ever national Girl Scout Cybersecurity badges for girls in grades K–12. This will allow us to work with girls across the U.S. and teach them about the cyberthreat landscape and best practices, as well as provide mentorship for young girls interested in cybersecurity.

I look forward to staying in touch with the diversity panel speakers and participants, and to working with the Girl Scouts to bring new, diversified talents and insights to cybersecurity.

[Palo Alto Networks Research Center]

Posted on

Tips for Gamifying Your Cybersecurity Education and Awareness Programs

Employees are fast becoming the weakest link in the defence against cybercriminals. Sometimes common sense can only go so far, as you need to make sure that best practices around security don’t go in one ear and out the other. Whether through innocent mistakes or because they were targeted for their access to sensitive information, employee error can easily open the door to malware or information theft.

Successful attacks often involve poor processes and exploit human tendencies. To reduce an organisation’s threat surface, the focus of regular employee training needs to shift from reaction to prevention. Pure compliance-driven approaches have proven to be ineffective for organisations when used for employee security training, usually because it isn’t interesting or personal enough to capture employees’ imaginations. Businesses should focus on educating employees about how to protect their personal data, thereby encouraging employees to enact further security-orientated practices in the workplace.

Employee training may take different forms, including the increasing practice of “gamifying” cybersecurity education programs. Gamification is the process of using gaming mechanics in a non-gaming context, leveraging what is exciting about games and applying it to other types of activities that may not be so fun. Designed with elements of competition and reward, gamification programs are becoming popular because they can be used within a variety of industries.

Many businesses currently use gamification in such areas as customer engagement, and employee education and training to drive performance and motivation. Gaming elements include one-on-one competitions, rewards programs, and more.

There are two key ways business owners can use gamification as a way of addressing cybersecurity in their organisation:

1. Make training more exciting and engaging for employees

Using gamification can help businesses improve their cybersecurity in numerous ways, including showing employees how to avoid cyberattacks and learning about vulnerabilities in software.

Global consulting firm PwC teaches cybersecurity through its Game of Threats. [1] Executives compete against each other in real-world cybersecurity situations, playing as either attackers or defenders. Attackers choose the tactics, methods, and skills of attack, while defenders develop (defence) strategies, and invest in the right technologies and talent to respond to the attack. The game gives executives an understanding of how to prepare for and react to threats, how well-prepared the company is, and what their cybersecurity teams face each day.

Gamifying will help make the training process more exciting and engaging for employees, increasing employee awareness of cybersecurity practices, including how to deal with attacks correctly.

2. Offer incentives and rewards to encourage desired behaviours

Human error is responsible in most security breaches, with employees feeling pressured to complete work by certain deadlines and as quickly as possible, which can result in them overlooking important company policy regarding security.

For example, running so-called PhishMe campaigns can be a great way to train employees on better email security. These include regular phishing emails sent across the organisation, testing the staff’s response and action.

Gamification lets businesses reward those employees who follow security procedures and adhere to the correct security guidelines, which will further promote good behaviour. This may take the form of employees receiving a badge or recording points, which are then displayed on a scoreboard for the office to follow. In some organisations, after employees reach specific milestones, they are presented with a material reward, such as a gift voucher.

This system also allows for the identification of those who display poor behaviour within gamification and may result in the employee needing to complete further cybersecurity training. Recognising and rewarding employees when they do the correct thing leads to continued positive behaviour, motivating employees to undertake safe practices and resulting in a more cyber-secure working environment.

At the heart of any security awareness training is education to teach employees a shared sense of responsibility for the data they work with, and the data they create and use at home. All security awareness campaigns should become part of an ongoing process, not a one-time initiative. Leaders of any business, big or small, can sometimes feel they lack the resources needed to drive an effective cybersecurity education campaign, but this can be done without breaking the bank.

  • Visual aids work well. Start with some small videos, posters and/or contests as a reminder to drive the message home for all to understand that security is everyone’s responsibility.
  • ‘Fear of God’ tactics do not work. The business goal should be to build a culture of cyber awareness, so treat this like a marketing campaign with the intent to persuade and change the behaviour of an employee.
  • Short and concise work best. Long emails always get ignored. Keep them short and fun, and ALWAYS ensure it is a top-down approach. Employees look up to their leaders. If the leaders do not embody a cyber-secure culture, why should the employees? The aim is to educate employees about best practices, not force them to be cybersecurity experts. Make it fun and have a laugh, so everyone can learn at the same time.
  • Reinforcement and follow-up are key. Training is a constant; learn from what works and re-educate as needed. Re-test your newly onboarded, as well as existing, staff members on whether they fall for a phishing email, and check to see how many employees still fail to recognise a fake email. Encourage communication to report a fake and call out departmental groups that may be lagging. The aim is not to single people out, but rather create some healthy rivalry within the organisation.

Eliminating cyber risks in any business is an ongoing process, but it can be managed. We need to foster a way for employees to call out where they question something and re-educate as needed. If employees walk away from the security awareness program questioning before they click on something malicious, you have moved the needle towards being more secure.

[1] https://www.pwc.com/us/en/financial-services/cybersecurity-privacy/game-of-threats.html

[Palo Alto Networks Research Center]

Posted on

Palo Alto Networks Joins the European Commission’s Digital Skills and Jobs Coalition

This month Palo Alto Networks proudly joined the European Commission’s Digital Skills and Jobs Coalition. This coalition brings together European Union (EU) member states, companies, social partners, non-profit organisations and education providers, all of whom are taking action to boost digital skills in Europe. Members of the coalition have endorsed its objectives and principles: to build strong partnerships and work together to reduce digital skills gaps in Europe, including training young people, supporting “upskilling” and retraining of the workforce in technical areas, and modernizing education. Members also can pledge to carry out initiatives to tackle the digital skills gap, an area in which Palo Alto Networks has already been active.

Within the Digital Skills and Jobs Coalition, we will address two important aspects of cybersecurity: providing students with training in technical skills and raising awareness about the importance of cybersecurity at the organizational board and C-suite levels. Both activities are essential for improving cybersecurity, preventing successful cyberattacks and maintaining trust in the digital age. With today’s threats growing in volume and sophistication, it is more critical than ever to arm colleges and universities with the latest cybersecurity curriculum to ensure our future generations have the necessary skills to prevent successful cyberattacks. At the same time, companies and other organisations need to prioritize strengthening their own cybersecurity. This is where boards of directors and the C-suite have a role. Senior executives need to understand and manage cybersecurity risks and guide their organizations – whether in the private or public sectors – to make the appropriate investments in cybersecurity.

Palo Alto Networks commitments within the Digital Skills and Jobs Coalition are encapsulated in two of our signature efforts:

1. Palo Alto Networks Academy Program: Training students with hands-on cybersecurity knowledge

The International Information System Security Certification Consortium, or (ISC)2, forecasts an overall cybersecurity skills shortage of 350,000 workers in Europe by 2022. Security professionals across the public and private sectors alike agree that cybersecurity training must be considered a high priority as the sophistication and volume of successful cyberattacks increase, threatening our digital way of life. Palo Alto Networks is committed to equipping this next generation of students with the hands-on cybersecurity knowledge they will need to keep pace with the ever-changing global cyberthreat landscape and learn best practices for preventing cyberattacks. The Palo Alto Networks Academy will provide cybersecurity courseware, certifications, faculty training, instructional resources and next-generation security platform lab technology at no cost to qualified European academic institutions. We will also be actively involved in sponsoring and supporting collegiate and secondary cybersecurity competitions in Europe. The start of this project is scheduled for the third quarter of 2017.

As of June 2017, nearly 40 educational institutions in the EU were members of the Palo Alto Networks Cyber Academy Program. In the 2016–2017 school year, we are training more than 400 students in the EU. Under the Digital Skills and Jobs Coalition, we’ve pledged to train 2,000 students by the end of 2018 and add 80 new qualified European academic institutions to our Authorized Academy Program by the end of 2018.

2. Navigating the Digital Age books: Educating CEOs and boards of directors across Europe on cybersecurity as a business issue

Palo Alto Networks believes cybersecurity is a business issue, not simply an IT issue. Today’s businesses must have the knowledge base, skills and tools needed to mitigate the cyber risks inherent in our digital age. Palo Alto Networks pledges to bring cybersecurity awareness to the European C-suite, in government agencies and in the private sector, by leveraging the European editions of our book series, “Navigating the Digital Age: The Definitive Cybersecurity Guide for Directors and Officers.” These books share best practices with chapters authored by European CEOs, CISOs, lawyers and consultants, as well as current and former government officials. Additionally, the books address current cybersecurity issues that businesses must consider, including how to manage strategic cybersecurity initiatives at the boardroom level, as well as how to navigate relevant EU and country-level legislation.

We have launched three European versions to date – France, United Kingdom and Benelux – all of which are available for free online. Under the Digital Skills and Jobs Coalition, we’ve pledged to distribute thousands of additional free copies of the books and hold roundtables and other events on the topics they cover. We would be pleased to join forces with governments throughout Europe to bring these messages to the C-suite in government agencies and the private sector.

Palo Alto Networks welcomes the European Commission’s emphasis on digital skills and education in the EU. As a member of the cybersecurity community, we have a deep interest in promoting and contributing to cybersecurity awareness and education throughout Europe. We are excited to join and contribute to the Digital Skills and Jobs Coalition, and look forward to working with its other stakeholders involved in digital skills development.

[Palo Alto Networks Research Center] 

English
English
Exit mobile version